Mikrotik-Group with Radius

RouterOS General
1

After attempting to setup a radius server (Microsoft Server 2008) and I am wanting to use the profiles in mikrotik using the Mikrotik-Group attribute

This is going to be used for pptp connections.

The issue I’m having is that the radius server appears to be sending a “MT-Group” instead of a “Mikrotik-Group” when responding with the access-accept.

Is this how it should be?

2

No. It should send Mikrotik-Group. I use this with the hotspot logins.
http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client
http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client/vendor_dictionary

Do you see this in the radius response in your router’s log?

3

Yes. When looking at the logs of the client mikrotik, the radius server is responding with the access-accept and then a classifier of;

MT-Group = “VPN”

I figured it was wrong.

Is there anyway to change that vendor-specific classifier in server 2008?

4

I hate to pester everyone but is there anyway to change the attribute within the server? I am really confused as to why it sends it as MT-Group instead of mikrotik-group

5

Did you define MikroTik dictionary (custom VSAs) on your RADIUS server?
http://technet.microsoft.com/en-us/library/cc731611(v=ws.10).aspx
What are currently defined Access-Accept atributes?

Regards,

6

I think the radius attribute is broken. I have now tried this same option with the mikrotik user manager and it is still sending MT-Group instead of Mikrotik-Group. Has anyone else had this issue? This is all with 6.23!

I don’t know if there is a way to change it or what but it is currently my only hurdle to using radius.

7

So it turns out all radius attributes are coming accross as MT-****** This must be a sumerization the is made for the logs. This is very annoying.

Aside from that, shouldn’t the MT-Group attribute work for ppp and choosing a profile?